1 /*-
2 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3 * The Regents of the University of California.
4 * Copyright (c) 2008 Robert N. M. Watson
5 * Copyright (c) 2010-2011 Juniper Networks, Inc.
6 * Copyright (c) 2014 Kevin Lo
7 * All rights reserved.
8 *
9 * Portions of this software were developed by Robert N. M. Watson under
10 * contract to Juniper Networks, Inc.
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 4. Neither the name of the University nor the names of its contributors
21 * may be used to endorse or promote products derived from this software
22 * without specific prior written permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 *
36 * @(#)udp_usrreq.c 8.6 (Berkeley) 5/23/95
37 */
38
39 #include <sys/cdefs.h>
40 __FBSDID("$FreeBSD$");
41
42 #include "opt_ipfw.h"
43 #include "opt_inet.h"
44 #include "opt_inet6.h"
45 #include "opt_ipsec.h"
46 #include "opt_kdtrace.h"
47
48 #include <sys/param.h>
49 #include <sys/domain.h>
50 #include <sys/eventhandler.h>
51 #include <sys/jail.h>
52 #include <sys/kernel.h>
53 #include <sys/lock.h>
54 #include <sys/malloc.h>
55 #include <sys/mbuf.h>
56 #include <sys/priv.h>
57 #include <sys/proc.h>
58 #include <sys/protosw.h>
59 #include <sys/sdt.h>
60 #include <sys/signalvar.h>
61 #include <sys/socket.h>
62 #include <sys/socketvar.h>
63 #include <sys/sx.h>
64 #include <sys/sysctl.h>
65 #include <sys/syslog.h>
66 #include <sys/systm.h>
67
68 #include <vm/uma.h>
69
70 #include <net/if.h>
71 #include <net/route.h>
72
73 #include <netinet/in.h>
74 #include <netinet/in_kdtrace.h>
75 #include <netinet/in_pcb.h>
76 #include <netinet/in_systm.h>
77 #include <netinet/in_var.h>
78 #include <netinet/ip.h>
79 #ifdef INET6
80 #include <netinet/ip6.h>
81 #endif
82 #include <netinet/ip_icmp.h>
83 #include <netinet/icmp_var.h>
84 #include <netinet/ip_var.h>
85 #include <netinet/ip_options.h>
86 #ifdef INET6
87 #include <netinet6/ip6_var.h>
88 #endif
89 #include <netinet/udp.h>
90 #include <netinet/udp_var.h>
91 #include <netinet/udplite.h>
92
93 #ifdef IPSEC
94 #include <netipsec/ipsec.h>
95 #include <netipsec/esp.h>
96 #endif
97
98 #include <machine/in_cksum.h>
99
100 #include <security/mac/mac_framework.h>
101
102 /*
103 * UDP and UDP-Lite protocols implementation.
104 * Per RFC 768, August, 1980.
105 * Per RFC 3828, July, 2004.
106 */
107
108 /*
109 * BSD 4.2 defaulted the udp checksum to be off. Turning off udp checksums
110 * removes the only data integrity mechanism for packets and malformed
111 * packets that would otherwise be discarded due to bad checksums, and may
112 * cause problems (especially for NFS data blocks).
113 */
114 VNET_DEFINE(int, udp_cksum) = 1;
115 SYSCTL_VNET_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum, CTLFLAG_RW,
116 &VNET_NAME(udp_cksum), 0, "compute udp checksum");
117
118 int udp_log_in_vain = 0;
119 SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_RW,
120 &udp_log_in_vain, 0, "Log all incoming UDP packets");
121
122 VNET_DEFINE(int, udp_blackhole) = 0;
123 SYSCTL_VNET_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_RW,
124 &VNET_NAME(udp_blackhole), 0,
125 "Do not send port unreachables for refused connects");
126
127 u_long udp_sendspace = 9216; /* really max datagram size */
128 /* 40 1K datagrams */
129 SYSCTL_ULONG(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram, CTLFLAG_RW,
130 &udp_sendspace, 0, "Maximum outgoing UDP datagram size");
131
132 u_long udp_recvspace = 40 * (1024 +
133 #ifdef INET6
134 sizeof(struct sockaddr_in6)
135 #else
136 sizeof(struct sockaddr_in)
137 #endif
138 );
139
140 SYSCTL_ULONG(_net_inet_udp, UDPCTL_RECVSPACE, recvspace, CTLFLAG_RW,
141 &udp_recvspace, 0, "Maximum space for incoming UDP datagrams");
142
143 VNET_DEFINE(struct inpcbhead, udb); /* from udp_var.h */
144 VNET_DEFINE(struct inpcbinfo, udbinfo);
145 VNET_DEFINE(struct inpcbhead, ulitecb);
146 VNET_DEFINE(struct inpcbinfo, ulitecbinfo);
147 static VNET_DEFINE(uma_zone_t, udpcb_zone);
148 #define V_udpcb_zone VNET(udpcb_zone)
149
150 #ifndef UDBHASHSIZE
151 #define UDBHASHSIZE 128
152 #endif
153
154 VNET_PCPUSTAT_DEFINE(struct udpstat, udpstat); /* from udp_var.h */
155 VNET_PCPUSTAT_SYSINIT(udpstat);
156 SYSCTL_VNET_PCPUSTAT(_net_inet_udp, UDPCTL_STATS, stats, struct udpstat,
157 udpstat, "UDP statistics (struct udpstat, netinet/udp_var.h)");
158
159 #ifdef VIMAGE
160 VNET_PCPUSTAT_SYSUNINIT(udpstat);
161 #endif /* VIMAGE */
162 #ifdef INET
163 static void udp_detach(struct socket *so);
164 static int udp_output(struct inpcb *, struct mbuf *, struct sockaddr *,
165 struct mbuf *, struct thread *);
166 #endif
167
168 #ifdef IPSEC
169 #ifdef IPSEC_NAT_T
170 #define UF_ESPINUDP_ALL (UF_ESPINUDP_NON_IKE|UF_ESPINUDP)
171 #ifdef INET
172 static struct mbuf *udp4_espdecap(struct inpcb *, struct mbuf *, int);
173 #endif
174 #endif /* IPSEC_NAT_T */
175 #endif /* IPSEC */
176
177 static void
udp_zone_change(void * tag)178 udp_zone_change(void *tag)
179 {
180
181 uma_zone_set_max(V_udbinfo.ipi_zone, maxsockets);
182 uma_zone_set_max(V_udpcb_zone, maxsockets);
183 }
184
185 static int
udp_inpcb_init(void * mem,int size,int flags)186 udp_inpcb_init(void *mem, int size, int flags)
187 {
188 struct inpcb *inp;
189
190 inp = mem;
191 INP_LOCK_INIT(inp, "inp", "udpinp");
192 return (0);
193 }
194
195 static int
udplite_inpcb_init(void * mem,int size,int flags)196 udplite_inpcb_init(void *mem, int size, int flags)
197 {
198 struct inpcb *inp;
199
200 inp = mem;
201 INP_LOCK_INIT(inp, "inp", "udpliteinp");
202 return (0);
203 }
204
205 void
udp_init(void)206 udp_init(void)
207 {
208
209 in_pcbinfo_init(&V_udbinfo, "udp", &V_udb, UDBHASHSIZE, UDBHASHSIZE,
210 "udp_inpcb", udp_inpcb_init, NULL, UMA_ZONE_NOFREE,
211 IPI_HASHFIELDS_2TUPLE);
212 V_udpcb_zone = uma_zcreate("udpcb", sizeof(struct udpcb),
213 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
214 uma_zone_set_max(V_udpcb_zone, maxsockets);
215 uma_zone_set_warning(V_udpcb_zone, "kern.ipc.maxsockets limit reached");
216 EVENTHANDLER_REGISTER(maxsockets_change, udp_zone_change, NULL,
217 EVENTHANDLER_PRI_ANY);
218 }
219
220 void
udplite_init(void)221 udplite_init(void)
222 {
223
224 in_pcbinfo_init(&V_ulitecbinfo, "udplite", &V_ulitecb, UDBHASHSIZE,
225 UDBHASHSIZE, "udplite_inpcb", udplite_inpcb_init, NULL,
226 UMA_ZONE_NOFREE, IPI_HASHFIELDS_2TUPLE);
227 }
228
229 /*
230 * Kernel module interface for updating udpstat. The argument is an index
231 * into udpstat treated as an array of u_long. While this encodes the
232 * general layout of udpstat into the caller, it doesn't encode its location,
233 * so that future changes to add, for example, per-CPU stats support won't
234 * cause binary compatibility problems for kernel modules.
235 */
236 void
kmod_udpstat_inc(int statnum)237 kmod_udpstat_inc(int statnum)
238 {
239
240 counter_u64_add(VNET(udpstat)[statnum], 1);
241 }
242
243 int
udp_newudpcb(struct inpcb * inp)244 udp_newudpcb(struct inpcb *inp)
245 {
246 struct udpcb *up;
247
248 up = uma_zalloc(V_udpcb_zone, M_NOWAIT | M_ZERO);
249 if (up == NULL)
250 return (ENOBUFS);
251 inp->inp_ppcb = up;
252 return (0);
253 }
254
255 void
udp_discardcb(struct udpcb * up)256 udp_discardcb(struct udpcb *up)
257 {
258
259 uma_zfree(V_udpcb_zone, up);
260 }
261
262 #ifdef VIMAGE
263 void
udp_destroy(void)264 udp_destroy(void)
265 {
266
267 in_pcbinfo_destroy(&V_udbinfo);
268 uma_zdestroy(V_udpcb_zone);
269 }
270
271 void
udplite_destroy(void)272 udplite_destroy(void)
273 {
274
275 in_pcbinfo_destroy(&V_ulitecbinfo);
276 }
277 #endif
278
279 #ifdef INET
280 /*
281 * Subroutine of udp_input(), which appends the provided mbuf chain to the
282 * passed pcb/socket. The caller must provide a sockaddr_in via udp_in that
283 * contains the source address. If the socket ends up being an IPv6 socket,
284 * udp_append() will convert to a sockaddr_in6 before passing the address
285 * into the socket code.
286 */
287 static void
udp_append(struct inpcb * inp,struct ip * ip,struct mbuf * n,int off,struct sockaddr_in * udp_in)288 udp_append(struct inpcb *inp, struct ip *ip, struct mbuf *n, int off,
289 struct sockaddr_in *udp_in)
290 {
291 struct sockaddr *append_sa;
292 struct socket *so;
293 struct mbuf *opts = 0;
294 #ifdef INET6
295 struct sockaddr_in6 udp_in6;
296 #endif
297 struct udpcb *up;
298
299 INP_LOCK_ASSERT(inp);
300
301 /*
302 * Engage the tunneling protocol.
303 */
304 up = intoudpcb(inp);
305 if (up->u_tun_func != NULL) {
306 (*up->u_tun_func)(n, off, inp, (struct sockaddr *)udp_in,
307 up->u_tun_ctx);
308 return;
309 }
310
311 off += sizeof(struct udphdr);
312
313 #ifdef IPSEC
314 /* Check AH/ESP integrity. */
315 if (ipsec4_in_reject(n, inp)) {
316 m_freem(n);
317 IPSECSTAT_INC(ips_in_polvio);
318 return;
319 }
320 #ifdef IPSEC_NAT_T
321 up = intoudpcb(inp);
322 KASSERT(up != NULL, ("%s: udpcb NULL", __func__));
323 if (up->u_flags & UF_ESPINUDP_ALL) { /* IPSec UDP encaps. */
324 n = udp4_espdecap(inp, n, off);
325 if (n == NULL) /* Consumed. */
326 return;
327 }
328 #endif /* IPSEC_NAT_T */
329 #endif /* IPSEC */
330 #ifdef MAC
331 if (mac_inpcb_check_deliver(inp, n) != 0) {
332 m_freem(n);
333 return;
334 }
335 #endif /* MAC */
336 if (inp->inp_flags & INP_CONTROLOPTS ||
337 inp->inp_socket->so_options & (SO_TIMESTAMP | SO_BINTIME)) {
338 #ifdef INET6
339 if (inp->inp_vflag & INP_IPV6)
340 (void)ip6_savecontrol_v4(inp, n, &opts, NULL);
341 else
342 #endif /* INET6 */
343 ip_savecontrol(inp, &opts, ip, n);
344 }
345 #ifdef INET6
346 if (inp->inp_vflag & INP_IPV6) {
347 bzero(&udp_in6, sizeof(udp_in6));
348 udp_in6.sin6_len = sizeof(udp_in6);
349 udp_in6.sin6_family = AF_INET6;
350 in6_sin_2_v4mapsin6(udp_in, &udp_in6);
351 append_sa = (struct sockaddr *)&udp_in6;
352 } else
353 #endif /* INET6 */
354 append_sa = (struct sockaddr *)udp_in;
355 m_adj(n, off);
356
357 so = inp->inp_socket;
358 SOCKBUF_LOCK(&so->so_rcv);
359 if (sbappendaddr_locked(&so->so_rcv, append_sa, n, opts) == 0) {
360 SOCKBUF_UNLOCK(&so->so_rcv);
361 m_freem(n);
362 if (opts)
363 m_freem(opts);
364 UDPSTAT_INC(udps_fullsock);
365 } else
366 sorwakeup_locked(so);
367 }
368
369 void
udp_input(struct mbuf * m,int off)370 udp_input(struct mbuf *m, int off)
371 {
372 int iphlen = off;
373 struct ip *ip;
374 struct udphdr *uh;
375 struct ifnet *ifp;
376 struct inpcb *inp;
377 uint16_t len, ip_len;
378 struct inpcbinfo *pcbinfo;
379 struct ip save_ip;
380 struct sockaddr_in udp_in;
381 struct m_tag *fwd_tag;
382 int cscov_partial;
383 uint8_t pr;
384
385 ifp = m->m_pkthdr.rcvif;
386 UDPSTAT_INC(udps_ipackets);
387
388 /*
389 * Strip IP options, if any; should skip this, make available to
390 * user, and use on returned packets, but we don't yet have a way to
391 * check the checksum with options still present.
392 */
393 if (iphlen > sizeof (struct ip)) {
394 ip_stripoptions(m);
395 iphlen = sizeof(struct ip);
396 }
397
398 /*
399 * Get IP and UDP header together in first mbuf.
400 */
401 ip = mtod(m, struct ip *);
402 if (m->m_len < iphlen + sizeof(struct udphdr)) {
403 if ((m = m_pullup(m, iphlen + sizeof(struct udphdr))) == NULL) {
404 UDPSTAT_INC(udps_hdrops);
405 return;
406 }
407 ip = mtod(m, struct ip *);
408 }
409 uh = (struct udphdr *)((caddr_t)ip + iphlen);
410 pr = ip->ip_p;
411 cscov_partial = (pr == IPPROTO_UDPLITE) ? 1 : 0;
412
413 /*
414 * Destination port of 0 is illegal, based on RFC768.
415 */
416 if (uh->uh_dport == 0)
417 goto badunlocked;
418
419 /*
420 * Construct sockaddr format source address. Stuff source address
421 * and datagram in user buffer.
422 */
423 bzero(&udp_in, sizeof(udp_in));
424 udp_in.sin_len = sizeof(udp_in);
425 udp_in.sin_family = AF_INET;
426 udp_in.sin_port = uh->uh_sport;
427 udp_in.sin_addr = ip->ip_src;
428
429 /*
430 * Make mbuf data length reflect UDP length. If not enough data to
431 * reflect UDP length, drop.
432 */
433 len = ntohs((u_short)uh->uh_ulen);
434 ip_len = ntohs(ip->ip_len) - iphlen;
435 if (pr == IPPROTO_UDPLITE && (len == 0 || len == ip_len)) {
436 /* Zero means checksum over the complete packet. */
437 if (len == 0)
438 len = ip_len;
439 cscov_partial = 0;
440 }
441 if (ip_len != len) {
442 if (len > ip_len || len < sizeof(struct udphdr)) {
443 UDPSTAT_INC(udps_badlen);
444 goto badunlocked;
445 }
446 if (pr == IPPROTO_UDP)
447 m_adj(m, len - ip_len);
448 }
449
450 /*
451 * Save a copy of the IP header in case we want restore it for
452 * sending an ICMP error message in response.
453 */
454 if (!V_udp_blackhole)
455 save_ip = *ip;
456 else
457 memset(&save_ip, 0, sizeof(save_ip));
458
459 /*
460 * Checksum extended UDP header and data.
461 */
462 if (uh->uh_sum) {
463 u_short uh_sum;
464
465 if ((m->m_pkthdr.csum_flags & CSUM_DATA_VALID) &&
466 !cscov_partial) {
467 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
468 uh_sum = m->m_pkthdr.csum_data;
469 else
470 uh_sum = in_pseudo(ip->ip_src.s_addr,
471 ip->ip_dst.s_addr, htonl((u_short)len +
472 m->m_pkthdr.csum_data + pr));
473 uh_sum ^= 0xffff;
474 } else {
475 char b[9];
476
477 bcopy(((struct ipovly *)ip)->ih_x1, b, 9);
478 bzero(((struct ipovly *)ip)->ih_x1, 9);
479 ((struct ipovly *)ip)->ih_len = (pr == IPPROTO_UDP) ?
480 uh->uh_ulen : htons(ip_len);
481 uh_sum = in_cksum(m, len + sizeof (struct ip));
482 bcopy(b, ((struct ipovly *)ip)->ih_x1, 9);
483 }
484 if (uh_sum) {
485 UDPSTAT_INC(udps_badsum);
486 m_freem(m);
487 return;
488 }
489 } else {
490 if (pr == IPPROTO_UDP) {
491 UDPSTAT_INC(udps_nosum);
492 } else {
493 /* UDPLite requires a checksum */
494 /* XXX: What is the right UDPLite MIB counter here? */
495 m_freem(m);
496 return;
497 }
498 }
499
500 pcbinfo = get_inpcbinfo(pr);
501 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
502 in_broadcast(ip->ip_dst, ifp)) {
503 struct inpcb *last;
504 struct inpcbhead *pcblist;
505 struct ip_moptions *imo;
506
507 INP_INFO_RLOCK(pcbinfo);
508 pcblist = get_pcblist(pr);
509 last = NULL;
510 LIST_FOREACH(inp, pcblist, inp_list) {
511 if (inp->inp_lport != uh->uh_dport)
512 continue;
513 #ifdef INET6
514 if ((inp->inp_vflag & INP_IPV4) == 0)
515 continue;
516 #endif
517 if (inp->inp_laddr.s_addr != INADDR_ANY &&
518 inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
519 continue;
520 if (inp->inp_faddr.s_addr != INADDR_ANY &&
521 inp->inp_faddr.s_addr != ip->ip_src.s_addr)
522 continue;
523 if (inp->inp_fport != 0 &&
524 inp->inp_fport != uh->uh_sport)
525 continue;
526
527 INP_RLOCK(inp);
528
529 /*
530 * XXXRW: Because we weren't holding either the inpcb
531 * or the hash lock when we checked for a match
532 * before, we should probably recheck now that the
533 * inpcb lock is held.
534 */
535
536 /*
537 * Handle socket delivery policy for any-source
538 * and source-specific multicast. [RFC3678]
539 */
540 imo = inp->inp_moptions;
541 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
542 struct sockaddr_in group;
543 int blocked;
544 if (imo == NULL) {
545 INP_RUNLOCK(inp);
546 continue;
547 }
548 bzero(&group, sizeof(struct sockaddr_in));
549 group.sin_len = sizeof(struct sockaddr_in);
550 group.sin_family = AF_INET;
551 group.sin_addr = ip->ip_dst;
552
553 blocked = imo_multi_filter(imo, ifp,
554 (struct sockaddr *)&group,
555 (struct sockaddr *)&udp_in);
556 if (blocked != MCAST_PASS) {
557 if (blocked == MCAST_NOTGMEMBER)
558 IPSTAT_INC(ips_notmember);
559 if (blocked == MCAST_NOTSMEMBER ||
560 blocked == MCAST_MUTED)
561 UDPSTAT_INC(udps_filtermcast);
562 INP_RUNLOCK(inp);
563 continue;
564 }
565 }
566 if (last != NULL) {
567 struct mbuf *n;
568
569 if ((n = m_copy(m, 0, M_COPYALL)) != NULL) {
570 UDP_PROBE(receive, NULL, last, ip,
571 last, uh);
572 udp_append(last, ip, n, iphlen,
573 &udp_in);
574 }
575 INP_RUNLOCK(last);
576 }
577 last = inp;
578 /*
579 * Don't look for additional matches if this one does
580 * not have either the SO_REUSEPORT or SO_REUSEADDR
581 * socket options set. This heuristic avoids
582 * searching through all pcbs in the common case of a
583 * non-shared port. It assumes that an application
584 * will never clear these options after setting them.
585 */
586 if ((last->inp_socket->so_options &
587 (SO_REUSEPORT|SO_REUSEADDR)) == 0)
588 break;
589 }
590
591 if (last == NULL) {
592 /*
593 * No matching pcb found; discard datagram. (No need
594 * to send an ICMP Port Unreachable for a broadcast
595 * or multicast datgram.)
596 */
597 UDPSTAT_INC(udps_noportbcast);
598 if (inp)
599 INP_RUNLOCK(inp);
600 INP_INFO_RUNLOCK(pcbinfo);
601 goto badunlocked;
602 }
603 UDP_PROBE(receive, NULL, last, ip, last, uh);
604 udp_append(last, ip, m, iphlen, &udp_in);
605 INP_RUNLOCK(last);
606 INP_INFO_RUNLOCK(pcbinfo);
607 return;
608 }
609
610 /*
611 * Locate pcb for datagram.
612 */
613
614 /*
615 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
616 */
617 if ((m->m_flags & M_IP_NEXTHOP) &&
618 (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
619 struct sockaddr_in *next_hop;
620
621 next_hop = (struct sockaddr_in *)(fwd_tag + 1);
622
623 /*
624 * Transparently forwarded. Pretend to be the destination.
625 * Already got one like this?
626 */
627 inp = in_pcblookup_mbuf(pcbinfo, ip->ip_src, uh->uh_sport,
628 ip->ip_dst, uh->uh_dport, INPLOOKUP_RLOCKPCB, ifp, m);
629 if (!inp) {
630 /*
631 * It's new. Try to find the ambushing socket.
632 * Because we've rewritten the destination address,
633 * any hardware-generated hash is ignored.
634 */
635 inp = in_pcblookup(pcbinfo, ip->ip_src,
636 uh->uh_sport, next_hop->sin_addr,
637 next_hop->sin_port ? htons(next_hop->sin_port) :
638 uh->uh_dport, INPLOOKUP_WILDCARD |
639 INPLOOKUP_RLOCKPCB, ifp);
640 }
641 /* Remove the tag from the packet. We don't need it anymore. */
642 m_tag_delete(m, fwd_tag);
643 m->m_flags &= ~M_IP_NEXTHOP;
644 } else
645 inp = in_pcblookup_mbuf(pcbinfo, ip->ip_src, uh->uh_sport,
646 ip->ip_dst, uh->uh_dport, INPLOOKUP_WILDCARD |
647 INPLOOKUP_RLOCKPCB, ifp, m);
648 if (inp == NULL) {
649 if (udp_log_in_vain) {
650 char buf[4*sizeof "123"];
651
652 strcpy(buf, inet_ntoa(ip->ip_dst));
653 log(LOG_INFO,
654 "Connection attempt to UDP %s:%d from %s:%d\n",
655 buf, ntohs(uh->uh_dport), inet_ntoa(ip->ip_src),
656 ntohs(uh->uh_sport));
657 }
658 UDPSTAT_INC(udps_noport);
659 if (m->m_flags & (M_BCAST | M_MCAST)) {
660 UDPSTAT_INC(udps_noportbcast);
661 goto badunlocked;
662 }
663 if (V_udp_blackhole)
664 goto badunlocked;
665 if (badport_bandlim(BANDLIM_ICMP_UNREACH) < 0)
666 goto badunlocked;
667 *ip = save_ip;
668 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
669 return;
670 }
671
672 /*
673 * Check the minimum TTL for socket.
674 */
675 INP_RLOCK_ASSERT(inp);
676 if (inp->inp_ip_minttl && inp->inp_ip_minttl > ip->ip_ttl) {
677 INP_RUNLOCK(inp);
678 m_freem(m);
679 return;
680 }
681 if (cscov_partial) {
682 struct udpcb *up;
683
684 up = intoudpcb(inp);
685 if (up->u_rxcslen == 0 || up->u_rxcslen > len) {
686 INP_RUNLOCK(inp);
687 m_freem(m);
688 return;
689 }
690 }
691
692 UDP_PROBE(receive, NULL, inp, ip, inp, uh);
693 udp_append(inp, ip, m, iphlen, &udp_in);
694 INP_RUNLOCK(inp);
695 return;
696
697 badunlocked:
698 m_freem(m);
699 }
700 #endif /* INET */
701
702 /*
703 * Notify a udp user of an asynchronous error; just wake up so that they can
704 * collect error status.
705 */
706 struct inpcb *
udp_notify(struct inpcb * inp,int errno)707 udp_notify(struct inpcb *inp, int errno)
708 {
709
710 /*
711 * While udp_ctlinput() always calls udp_notify() with a read lock
712 * when invoking it directly, in_pcbnotifyall() currently uses write
713 * locks due to sharing code with TCP. For now, accept either a read
714 * or a write lock, but a read lock is sufficient.
715 */
716 INP_LOCK_ASSERT(inp);
717
718 inp->inp_socket->so_error = errno;
719 sorwakeup(inp->inp_socket);
720 sowwakeup(inp->inp_socket);
721 return (inp);
722 }
723
724 #ifdef INET
725 static void
udp_common_ctlinput(int cmd,struct sockaddr * sa,void * vip,struct inpcbinfo * pcbinfo)726 udp_common_ctlinput(int cmd, struct sockaddr *sa, void *vip,
727 struct inpcbinfo *pcbinfo)
728 {
729 struct ip *ip = vip;
730 struct udphdr *uh;
731 struct in_addr faddr;
732 struct inpcb *inp;
733
734 faddr = ((struct sockaddr_in *)sa)->sin_addr;
735 if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
736 return;
737
738 /*
739 * Redirects don't need to be handled up here.
740 */
741 if (PRC_IS_REDIRECT(cmd))
742 return;
743
744 /*
745 * Hostdead is ugly because it goes linearly through all PCBs.
746 *
747 * XXX: We never get this from ICMP, otherwise it makes an excellent
748 * DoS attack on machines with many connections.
749 */
750 if (cmd == PRC_HOSTDEAD)
751 ip = NULL;
752 else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0)
753 return;
754 if (ip != NULL) {
755 uh = (struct udphdr *)((caddr_t)ip + (ip->ip_hl << 2));
756 inp = in_pcblookup(pcbinfo, faddr, uh->uh_dport,
757 ip->ip_src, uh->uh_sport, INPLOOKUP_RLOCKPCB, NULL);
758 if (inp != NULL) {
759 INP_RLOCK_ASSERT(inp);
760 if (inp->inp_socket != NULL) {
761 udp_notify(inp, inetctlerrmap[cmd]);
762 }
763 INP_RUNLOCK(inp);
764 }
765 } else
766 in_pcbnotifyall(pcbinfo, faddr, inetctlerrmap[cmd],
767 udp_notify);
768 }
769 void
udp_ctlinput(int cmd,struct sockaddr * sa,void * vip)770 udp_ctlinput(int cmd, struct sockaddr *sa, void *vip)
771 {
772
773 return (udp_common_ctlinput(cmd, sa, vip, &V_udbinfo));
774 }
775
776 void
udplite_ctlinput(int cmd,struct sockaddr * sa,void * vip)777 udplite_ctlinput(int cmd, struct sockaddr *sa, void *vip)
778 {
779
780 return (udp_common_ctlinput(cmd, sa, vip, &V_ulitecbinfo));
781 }
782 #endif /* INET */
783
784 static int
udp_pcblist(SYSCTL_HANDLER_ARGS)785 udp_pcblist(SYSCTL_HANDLER_ARGS)
786 {
787 int error, i, n;
788 struct inpcb *inp, **inp_list;
789 inp_gen_t gencnt;
790 struct xinpgen xig;
791
792 /*
793 * The process of preparing the PCB list is too time-consuming and
794 * resource-intensive to repeat twice on every request.
795 */
796 if (req->oldptr == 0) {
797 n = V_udbinfo.ipi_count;
798 n += imax(n / 8, 10);
799 req->oldidx = 2 * (sizeof xig) + n * sizeof(struct xinpcb);
800 return (0);
801 }
802
803 if (req->newptr != 0)
804 return (EPERM);
805
806 /*
807 * OK, now we're committed to doing something.
808 */
809 INP_INFO_RLOCK(&V_udbinfo);
810 gencnt = V_udbinfo.ipi_gencnt;
811 n = V_udbinfo.ipi_count;
812 INP_INFO_RUNLOCK(&V_udbinfo);
813
814 error = sysctl_wire_old_buffer(req, 2 * (sizeof xig)
815 + n * sizeof(struct xinpcb));
816 if (error != 0)
817 return (error);
818
819 xig.xig_len = sizeof xig;
820 xig.xig_count = n;
821 xig.xig_gen = gencnt;
822 xig.xig_sogen = so_gencnt;
823 error = SYSCTL_OUT(req, &xig, sizeof xig);
824 if (error)
825 return (error);
826
827 inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
828 if (inp_list == 0)
829 return (ENOMEM);
830
831 INP_INFO_RLOCK(&V_udbinfo);
832 for (inp = LIST_FIRST(V_udbinfo.ipi_listhead), i = 0; inp && i < n;
833 inp = LIST_NEXT(inp, inp_list)) {
834 INP_WLOCK(inp);
835 if (inp->inp_gencnt <= gencnt &&
836 cr_canseeinpcb(req->td->td_ucred, inp) == 0) {
837 in_pcbref(inp);
838 inp_list[i++] = inp;
839 }
840 INP_WUNLOCK(inp);
841 }
842 INP_INFO_RUNLOCK(&V_udbinfo);
843 n = i;
844
845 error = 0;
846 for (i = 0; i < n; i++) {
847 inp = inp_list[i];
848 INP_RLOCK(inp);
849 if (inp->inp_gencnt <= gencnt) {
850 struct xinpcb xi;
851
852 bzero(&xi, sizeof(xi));
853 xi.xi_len = sizeof xi;
854 /* XXX should avoid extra copy */
855 bcopy(inp, &xi.xi_inp, sizeof *inp);
856 if (inp->inp_socket)
857 sotoxsocket(inp->inp_socket, &xi.xi_socket);
858 xi.xi_inp.inp_gencnt = inp->inp_gencnt;
859 INP_RUNLOCK(inp);
860 error = SYSCTL_OUT(req, &xi, sizeof xi);
861 } else
862 INP_RUNLOCK(inp);
863 }
864 INP_INFO_WLOCK(&V_udbinfo);
865 for (i = 0; i < n; i++) {
866 inp = inp_list[i];
867 INP_RLOCK(inp);
868 if (!in_pcbrele_rlocked(inp))
869 INP_RUNLOCK(inp);
870 }
871 INP_INFO_WUNLOCK(&V_udbinfo);
872
873 if (!error) {
874 /*
875 * Give the user an updated idea of our state. If the
876 * generation differs from what we told her before, she knows
877 * that something happened while we were processing this
878 * request, and it might be necessary to retry.
879 */
880 INP_INFO_RLOCK(&V_udbinfo);
881 xig.xig_gen = V_udbinfo.ipi_gencnt;
882 xig.xig_sogen = so_gencnt;
883 xig.xig_count = V_udbinfo.ipi_count;
884 INP_INFO_RUNLOCK(&V_udbinfo);
885 error = SYSCTL_OUT(req, &xig, sizeof xig);
886 }
887 free(inp_list, M_TEMP);
888 return (error);
889 }
890
891 SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist,
892 CTLTYPE_OPAQUE | CTLFLAG_RD, NULL, 0,
893 udp_pcblist, "S,xinpcb", "List of active UDP sockets");
894
895 #ifdef INET
896 static int
udp_getcred(SYSCTL_HANDLER_ARGS)897 udp_getcred(SYSCTL_HANDLER_ARGS)
898 {
899 struct xucred xuc;
900 struct sockaddr_in addrs[2];
901 struct inpcb *inp;
902 int error;
903
904 error = priv_check(req->td, PRIV_NETINET_GETCRED);
905 if (error)
906 return (error);
907 error = SYSCTL_IN(req, addrs, sizeof(addrs));
908 if (error)
909 return (error);
910 inp = in_pcblookup(&V_udbinfo, addrs[1].sin_addr, addrs[1].sin_port,
911 addrs[0].sin_addr, addrs[0].sin_port,
912 INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB, NULL);
913 if (inp != NULL) {
914 INP_RLOCK_ASSERT(inp);
915 if (inp->inp_socket == NULL)
916 error = ENOENT;
917 if (error == 0)
918 error = cr_canseeinpcb(req->td->td_ucred, inp);
919 if (error == 0)
920 cru2x(inp->inp_cred, &xuc);
921 INP_RUNLOCK(inp);
922 } else
923 error = ENOENT;
924 if (error == 0)
925 error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
926 return (error);
927 }
928
929 SYSCTL_PROC(_net_inet_udp, OID_AUTO, getcred,
930 CTLTYPE_OPAQUE|CTLFLAG_RW|CTLFLAG_PRISON, 0, 0,
931 udp_getcred, "S,xucred", "Get the xucred of a UDP connection");
932 #endif /* INET */
933
934 int
udp_ctloutput(struct socket * so,struct sockopt * sopt)935 udp_ctloutput(struct socket *so, struct sockopt *sopt)
936 {
937 struct inpcb *inp;
938 struct udpcb *up;
939 int isudplite, error, optval;
940
941 error = 0;
942 isudplite = (so->so_proto->pr_protocol == IPPROTO_UDPLITE) ? 1 : 0;
943 inp = sotoinpcb(so);
944 KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
945 INP_WLOCK(inp);
946 if (sopt->sopt_level != so->so_proto->pr_protocol) {
947 #ifdef INET6
948 if (INP_CHECK_SOCKAF(so, AF_INET6)) {
949 INP_WUNLOCK(inp);
950 error = ip6_ctloutput(so, sopt);
951 }
952 #endif
953 #if defined(INET) && defined(INET6)
954 else
955 #endif
956 #ifdef INET
957 {
958 INP_WUNLOCK(inp);
959 error = ip_ctloutput(so, sopt);
960 }
961 #endif
962 return (error);
963 }
964
965 switch (sopt->sopt_dir) {
966 case SOPT_SET:
967 switch (sopt->sopt_name) {
968 case UDP_ENCAP:
969 INP_WUNLOCK(inp);
970 error = sooptcopyin(sopt, &optval, sizeof optval,
971 sizeof optval);
972 if (error)
973 break;
974 inp = sotoinpcb(so);
975 KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
976 INP_WLOCK(inp);
977 #ifdef IPSEC_NAT_T
978 up = intoudpcb(inp);
979 KASSERT(up != NULL, ("%s: up == NULL", __func__));
980 #endif
981 switch (optval) {
982 case 0:
983 /* Clear all UDP encap. */
984 #ifdef IPSEC_NAT_T
985 up->u_flags &= ~UF_ESPINUDP_ALL;
986 #endif
987 break;
988 #ifdef IPSEC_NAT_T
989 case UDP_ENCAP_ESPINUDP:
990 case UDP_ENCAP_ESPINUDP_NON_IKE:
991 up->u_flags &= ~UF_ESPINUDP_ALL;
992 if (optval == UDP_ENCAP_ESPINUDP)
993 up->u_flags |= UF_ESPINUDP;
994 else if (optval == UDP_ENCAP_ESPINUDP_NON_IKE)
995 up->u_flags |= UF_ESPINUDP_NON_IKE;
996 break;
997 #endif
998 default:
999 error = EINVAL;
1000 break;
1001 }
1002 INP_WUNLOCK(inp);
1003 break;
1004 case UDPLITE_SEND_CSCOV:
1005 case UDPLITE_RECV_CSCOV:
1006 if (!isudplite) {
1007 INP_WUNLOCK(inp);
1008 error = ENOPROTOOPT;
1009 break;
1010 }
1011 INP_WUNLOCK(inp);
1012 error = sooptcopyin(sopt, &optval, sizeof(optval),
1013 sizeof(optval));
1014 if (error != 0)
1015 break;
1016 inp = sotoinpcb(so);
1017 KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
1018 INP_WLOCK(inp);
1019 up = intoudpcb(inp);
1020 KASSERT(up != NULL, ("%s: up == NULL", __func__));
1021 if ((optval != 0 && optval < 8) || (optval > 65535)) {
1022 INP_WUNLOCK(inp);
1023 error = EINVAL;
1024 break;
1025 }
1026 if (sopt->sopt_name == UDPLITE_SEND_CSCOV)
1027 up->u_txcslen = optval;
1028 else
1029 up->u_rxcslen = optval;
1030 INP_WUNLOCK(inp);
1031 break;
1032 default:
1033 INP_WUNLOCK(inp);
1034 error = ENOPROTOOPT;
1035 break;
1036 }
1037 break;
1038 case SOPT_GET:
1039 switch (sopt->sopt_name) {
1040 #ifdef IPSEC_NAT_T
1041 case UDP_ENCAP:
1042 up = intoudpcb(inp);
1043 KASSERT(up != NULL, ("%s: up == NULL", __func__));
1044 optval = up->u_flags & UF_ESPINUDP_ALL;
1045 INP_WUNLOCK(inp);
1046 error = sooptcopyout(sopt, &optval, sizeof optval);
1047 break;
1048 #endif
1049 case UDPLITE_SEND_CSCOV:
1050 case UDPLITE_RECV_CSCOV:
1051 if (!isudplite) {
1052 INP_WUNLOCK(inp);
1053 error = ENOPROTOOPT;
1054 break;
1055 }
1056 up = intoudpcb(inp);
1057 KASSERT(up != NULL, ("%s: up == NULL", __func__));
1058 if (sopt->sopt_name == UDPLITE_SEND_CSCOV)
1059 optval = up->u_txcslen;
1060 else
1061 optval = up->u_rxcslen;
1062 INP_WUNLOCK(inp);
1063 error = sooptcopyout(sopt, &optval, sizeof(optval));
1064 break;
1065 default:
1066 INP_WUNLOCK(inp);
1067 error = ENOPROTOOPT;
1068 break;
1069 }
1070 break;
1071 }
1072 return (error);
1073 }
1074
1075 #ifdef INET
1076 #define UH_WLOCKED 2
1077 #define UH_RLOCKED 1
1078 #define UH_UNLOCKED 0
1079 static int
udp_output(struct inpcb * inp,struct mbuf * m,struct sockaddr * addr,struct mbuf * control,struct thread * td)1080 udp_output(struct inpcb *inp, struct mbuf *m, struct sockaddr *addr,
1081 struct mbuf *control, struct thread *td)
1082 {
1083 struct udpiphdr *ui;
1084 int len = m->m_pkthdr.len;
1085 struct in_addr faddr, laddr;
1086 struct cmsghdr *cm;
1087 struct inpcbinfo *pcbinfo;
1088 struct sockaddr_in *sin, src;
1089 int cscov_partial = 0;
1090 int error = 0;
1091 int ipflags;
1092 u_short fport, lport;
1093 int unlock_udbinfo;
1094 u_char tos;
1095 uint8_t pr;
1096 uint16_t cscov = 0;
1097
1098 /*
1099 * udp_output() may need to temporarily bind or connect the current
1100 * inpcb. As such, we don't know up front whether we will need the
1101 * pcbinfo lock or not. Do any work to decide what is needed up
1102 * front before acquiring any locks.
1103 */
1104 if (len + sizeof(struct udpiphdr) > IP_MAXPACKET) {
1105 if (control)
1106 m_freem(control);
1107 m_freem(m);
1108 return (EMSGSIZE);
1109 }
1110
1111 src.sin_family = 0;
1112 INP_RLOCK(inp);
1113 tos = inp->inp_ip_tos;
1114 if (control != NULL) {
1115 /*
1116 * XXX: Currently, we assume all the optional information is
1117 * stored in a single mbuf.
1118 */
1119 if (control->m_next) {
1120 INP_RUNLOCK(inp);
1121 m_freem(control);
1122 m_freem(m);
1123 return (EINVAL);
1124 }
1125 for (; control->m_len > 0;
1126 control->m_data += CMSG_ALIGN(cm->cmsg_len),
1127 control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
1128 cm = mtod(control, struct cmsghdr *);
1129 if (control->m_len < sizeof(*cm) || cm->cmsg_len == 0
1130 || cm->cmsg_len > control->m_len) {
1131 error = EINVAL;
1132 break;
1133 }
1134 if (cm->cmsg_level != IPPROTO_IP)
1135 continue;
1136
1137 switch (cm->cmsg_type) {
1138 case IP_SENDSRCADDR:
1139 if (cm->cmsg_len !=
1140 CMSG_LEN(sizeof(struct in_addr))) {
1141 error = EINVAL;
1142 break;
1143 }
1144 bzero(&src, sizeof(src));
1145 src.sin_family = AF_INET;
1146 src.sin_len = sizeof(src);
1147 src.sin_port = inp->inp_lport;
1148 src.sin_addr =
1149 *(struct in_addr *)CMSG_DATA(cm);
1150 break;
1151
1152 case IP_TOS:
1153 if (cm->cmsg_len != CMSG_LEN(sizeof(u_char))) {
1154 error = EINVAL;
1155 break;
1156 }
1157 tos = *(u_char *)CMSG_DATA(cm);
1158 break;
1159
1160 default:
1161 error = ENOPROTOOPT;
1162 break;
1163 }
1164 if (error)
1165 break;
1166 }
1167 m_freem(control);
1168 }
1169 if (error) {
1170 INP_RUNLOCK(inp);
1171 m_freem(m);
1172 return (error);
1173 }
1174
1175 /*
1176 * Depending on whether or not the application has bound or connected
1177 * the socket, we may have to do varying levels of work. The optimal
1178 * case is for a connected UDP socket, as a global lock isn't
1179 * required at all.
1180 *
1181 * In order to decide which we need, we require stability of the
1182 * inpcb binding, which we ensure by acquiring a read lock on the
1183 * inpcb. This doesn't strictly follow the lock order, so we play
1184 * the trylock and retry game; note that we may end up with more
1185 * conservative locks than required the second time around, so later
1186 * assertions have to accept that. Further analysis of the number of
1187 * misses under contention is required.
1188 *
1189 * XXXRW: Check that hash locking update here is correct.
1190 */
1191 pr = inp->inp_socket->so_proto->pr_protocol;
1192 pcbinfo = get_inpcbinfo(pr);
1193 sin = (struct sockaddr_in *)addr;
1194 if (sin != NULL &&
1195 (inp->inp_laddr.s_addr == INADDR_ANY && inp->inp_lport == 0)) {
1196 INP_RUNLOCK(inp);
1197 INP_WLOCK(inp);
1198 INP_HASH_WLOCK(pcbinfo);
1199 unlock_udbinfo = UH_WLOCKED;
1200 } else if ((sin != NULL && (
1201 (sin->sin_addr.s_addr == INADDR_ANY) ||
1202 (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
1203 (inp->inp_laddr.s_addr == INADDR_ANY) ||
1204 (inp->inp_lport == 0))) ||
1205 (src.sin_family == AF_INET)) {
1206 INP_HASH_RLOCK(pcbinfo);
1207 unlock_udbinfo = UH_RLOCKED;
1208 } else
1209 unlock_udbinfo = UH_UNLOCKED;
1210
1211 /*
1212 * If the IP_SENDSRCADDR control message was specified, override the
1213 * source address for this datagram. Its use is invalidated if the
1214 * address thus specified is incomplete or clobbers other inpcbs.
1215 */
1216 laddr = inp->inp_laddr;
1217 lport = inp->inp_lport;
1218 if (src.sin_family == AF_INET) {
1219 INP_HASH_LOCK_ASSERT(pcbinfo);
1220 if ((lport == 0) ||
1221 (laddr.s_addr == INADDR_ANY &&
1222 src.sin_addr.s_addr == INADDR_ANY)) {
1223 error = EINVAL;
1224 goto release;
1225 }
1226 error = in_pcbbind_setup(inp, (struct sockaddr *)&src,
1227 &laddr.s_addr, &lport, td->td_ucred);
1228 if (error)
1229 goto release;
1230 }
1231
1232 /*
1233 * If a UDP socket has been connected, then a local address/port will
1234 * have been selected and bound.
1235 *
1236 * If a UDP socket has not been connected to, then an explicit
1237 * destination address must be used, in which case a local
1238 * address/port may not have been selected and bound.
1239 */
1240 if (sin != NULL) {
1241 INP_LOCK_ASSERT(inp);
1242 if (inp->inp_faddr.s_addr != INADDR_ANY) {
1243 error = EISCONN;
1244 goto release;
1245 }
1246
1247 /*
1248 * Jail may rewrite the destination address, so let it do
1249 * that before we use it.
1250 */
1251 error = prison_remote_ip4(td->td_ucred, &sin->sin_addr);
1252 if (error)
1253 goto release;
1254
1255 /*
1256 * If a local address or port hasn't yet been selected, or if
1257 * the destination address needs to be rewritten due to using
1258 * a special INADDR_ constant, invoke in_pcbconnect_setup()
1259 * to do the heavy lifting. Once a port is selected, we
1260 * commit the binding back to the socket; we also commit the
1261 * binding of the address if in jail.
1262 *
1263 * If we already have a valid binding and we're not
1264 * requesting a destination address rewrite, use a fast path.
1265 */
1266 if (inp->inp_laddr.s_addr == INADDR_ANY ||
1267 inp->inp_lport == 0 ||
1268 sin->sin_addr.s_addr == INADDR_ANY ||
1269 sin->sin_addr.s_addr == INADDR_BROADCAST) {
1270 INP_HASH_LOCK_ASSERT(pcbinfo);
1271 error = in_pcbconnect_setup(inp, addr, &laddr.s_addr,
1272 &lport, &faddr.s_addr, &fport, NULL,
1273 td->td_ucred);
1274 if (error)
1275 goto release;
1276
1277 /*
1278 * XXXRW: Why not commit the port if the address is
1279 * !INADDR_ANY?
1280 */
1281 /* Commit the local port if newly assigned. */
1282 if (inp->inp_laddr.s_addr == INADDR_ANY &&
1283 inp->inp_lport == 0) {
1284 INP_WLOCK_ASSERT(inp);
1285 INP_HASH_WLOCK_ASSERT(pcbinfo);
1286 /*
1287 * Remember addr if jailed, to prevent
1288 * rebinding.
1289 */
1290 if (prison_flag(td->td_ucred, PR_IP4))
1291 inp->inp_laddr = laddr;
1292 inp->inp_lport = lport;
1293 if (in_pcbinshash(inp) != 0) {
1294 inp->inp_lport = 0;
1295 error = EAGAIN;
1296 goto release;
1297 }
1298 inp->inp_flags |= INP_ANONPORT;
1299 }
1300 } else {
1301 faddr = sin->sin_addr;
1302 fport = sin->sin_port;
1303 }
1304 } else {
1305 INP_LOCK_ASSERT(inp);
1306 faddr = inp->inp_faddr;
1307 fport = inp->inp_fport;
1308 if (faddr.s_addr == INADDR_ANY) {
1309 error = ENOTCONN;
1310 goto release;
1311 }
1312 }
1313
1314 /*
1315 * Calculate data length and get a mbuf for UDP, IP, and possible
1316 * link-layer headers. Immediate slide the data pointer back forward
1317 * since we won't use that space at this layer.
1318 */
1319 M_PREPEND(m, sizeof(struct udpiphdr) + max_linkhdr, M_NOWAIT);
1320 if (m == NULL) {
1321 error = ENOBUFS;
1322 goto release;
1323 }
1324 m->m_data += max_linkhdr;
1325 m->m_len -= max_linkhdr;
1326 m->m_pkthdr.len -= max_linkhdr;
1327
1328 /*
1329 * Fill in mbuf with extended UDP header and addresses and length put
1330 * into network format.
1331 */
1332 ui = mtod(m, struct udpiphdr *);
1333 bzero(ui->ui_x1, sizeof(ui->ui_x1)); /* XXX still needed? */
1334 ui->ui_pr = pr;
1335 ui->ui_src = laddr;
1336 ui->ui_dst = faddr;
1337 ui->ui_sport = lport;
1338 ui->ui_dport = fport;
1339 ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
1340 if (pr == IPPROTO_UDPLITE) {
1341 struct udpcb *up;
1342 uint16_t plen;
1343
1344 up = intoudpcb(inp);
1345 cscov = up->u_txcslen;
1346 plen = (u_short)len + sizeof(struct udphdr);
1347 if (cscov >= plen)
1348 cscov = 0;
1349 ui->ui_len = htons(plen);
1350 ui->ui_ulen = htons(cscov);
1351 /*
1352 * For UDP-Lite, checksum coverage length of zero means
1353 * the entire UDPLite packet is covered by the checksum.
1354 */
1355 cscov_partial = (cscov == 0) ? 0 : 1;
1356 } else
1357 ui->ui_v = IPVERSION << 4;
1358
1359 /*
1360 * Set the Don't Fragment bit in the IP header.
1361 */
1362 if (inp->inp_flags & INP_DONTFRAG) {
1363 struct ip *ip;
1364
1365 ip = (struct ip *)&ui->ui_i;
1366 ip->ip_off |= htons(IP_DF);
1367 }
1368
1369 ipflags = 0;
1370 if (inp->inp_socket->so_options & SO_DONTROUTE)
1371 ipflags |= IP_ROUTETOIF;
1372 if (inp->inp_socket->so_options & SO_BROADCAST)
1373 ipflags |= IP_ALLOWBROADCAST;
1374 if (inp->inp_flags & INP_ONESBCAST)
1375 ipflags |= IP_SENDONES;
1376
1377 #ifdef MAC
1378 mac_inpcb_create_mbuf(inp, m);
1379 #endif
1380
1381 /*
1382 * Set up checksum and output datagram.
1383 */
1384 ui->ui_sum = 0;
1385 if (pr == IPPROTO_UDPLITE) {
1386 if (inp->inp_flags & INP_ONESBCAST)
1387 faddr.s_addr = INADDR_BROADCAST;
1388 if (cscov_partial) {
1389 if ((ui->ui_sum = in_cksum(m, sizeof(struct ip) + cscov)) == 0)
1390 ui->ui_sum = 0xffff;
1391 } else {
1392 if ((ui->ui_sum = in_cksum(m, sizeof(struct udpiphdr) + len)) == 0)
1393 ui->ui_sum = 0xffff;
1394 }
1395 } else if (V_udp_cksum) {
1396 if (inp->inp_flags & INP_ONESBCAST)
1397 faddr.s_addr = INADDR_BROADCAST;
1398 ui->ui_sum = in_pseudo(ui->ui_src.s_addr, faddr.s_addr,
1399 htons((u_short)len + sizeof(struct udphdr) + pr));
1400 m->m_pkthdr.csum_flags = CSUM_UDP;
1401 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
1402 }
1403 ((struct ip *)ui)->ip_len = htons(sizeof(struct udpiphdr) + len);
1404 ((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl; /* XXX */
1405 ((struct ip *)ui)->ip_tos = tos; /* XXX */
1406 UDPSTAT_INC(udps_opackets);
1407
1408 if (unlock_udbinfo == UH_WLOCKED)
1409 INP_HASH_WUNLOCK(pcbinfo);
1410 else if (unlock_udbinfo == UH_RLOCKED)
1411 INP_HASH_RUNLOCK(pcbinfo);
1412 UDP_PROBE(send, NULL, inp, &ui->ui_i, inp, &ui->ui_u);
1413 error = ip_output(m, inp->inp_options, NULL, ipflags,
1414 inp->inp_moptions, inp);
1415 if (unlock_udbinfo == UH_WLOCKED)
1416 INP_WUNLOCK(inp);
1417 else
1418 INP_RUNLOCK(inp);
1419 return (error);
1420
1421 release:
1422 if (unlock_udbinfo == UH_WLOCKED) {
1423 INP_HASH_WUNLOCK(pcbinfo);
1424 INP_WUNLOCK(inp);
1425 } else if (unlock_udbinfo == UH_RLOCKED) {
1426 INP_HASH_RUNLOCK(pcbinfo);
1427 INP_RUNLOCK(inp);
1428 } else
1429 INP_RUNLOCK(inp);
1430 m_freem(m);
1431 return (error);
1432 }
1433
1434
1435 #if defined(IPSEC) && defined(IPSEC_NAT_T)
1436 /*
1437 * Potentially decap ESP in UDP frame. Check for an ESP header
1438 * and optional marker; if present, strip the UDP header and
1439 * push the result through IPSec.
1440 *
1441 * Returns mbuf to be processed (potentially re-allocated) or
1442 * NULL if consumed and/or processed.
1443 */
1444 static struct mbuf *
udp4_espdecap(struct inpcb * inp,struct mbuf * m,int off)1445 udp4_espdecap(struct inpcb *inp, struct mbuf *m, int off)
1446 {
1447 size_t minlen, payload, skip, iphlen;
1448 caddr_t data;
1449 struct udpcb *up;
1450 struct m_tag *tag;
1451 struct udphdr *udphdr;
1452 struct ip *ip;
1453
1454 INP_RLOCK_ASSERT(inp);
1455
1456 /*
1457 * Pull up data so the longest case is contiguous:
1458 * IP/UDP hdr + non ESP marker + ESP hdr.
1459 */
1460 minlen = off + sizeof(uint64_t) + sizeof(struct esp);
1461 if (minlen > m->m_pkthdr.len)
1462 minlen = m->m_pkthdr.len;
1463 if ((m = m_pullup(m, minlen)) == NULL) {
1464 IPSECSTAT_INC(ips_in_inval);
1465 return (NULL); /* Bypass caller processing. */
1466 }
1467 data = mtod(m, caddr_t); /* Points to ip header. */
1468 payload = m->m_len - off; /* Size of payload. */
1469
1470 if (payload == 1 && data[off] == '\xff')
1471 return (m); /* NB: keepalive packet, no decap. */
1472
1473 up = intoudpcb(inp);
1474 KASSERT(up != NULL, ("%s: udpcb NULL", __func__));
1475 KASSERT((up->u_flags & UF_ESPINUDP_ALL) != 0,
1476 ("u_flags 0x%x", up->u_flags));
1477
1478 /*
1479 * Check that the payload is large enough to hold an
1480 * ESP header and compute the amount of data to remove.
1481 *
1482 * NB: the caller has already done a pullup for us.
1483 * XXX can we assume alignment and eliminate bcopys?
1484 */
1485 if (up->u_flags & UF_ESPINUDP_NON_IKE) {
1486 /*
1487 * draft-ietf-ipsec-nat-t-ike-0[01].txt and
1488 * draft-ietf-ipsec-udp-encaps-(00/)01.txt, ignoring
1489 * possible AH mode non-IKE marker+non-ESP marker
1490 * from draft-ietf-ipsec-udp-encaps-00.txt.
1491 */
1492 uint64_t marker;
1493
1494 if (payload <= sizeof(uint64_t) + sizeof(struct esp))
1495 return (m); /* NB: no decap. */
1496 bcopy(data + off, &marker, sizeof(uint64_t));
1497 if (marker != 0) /* Non-IKE marker. */
1498 return (m); /* NB: no decap. */
1499 skip = sizeof(uint64_t) + sizeof(struct udphdr);
1500 } else {
1501 uint32_t spi;
1502
1503 if (payload <= sizeof(struct esp)) {
1504 IPSECSTAT_INC(ips_in_inval);
1505 m_freem(m);
1506 return (NULL); /* Discard. */
1507 }
1508 bcopy(data + off, &spi, sizeof(uint32_t));
1509 if (spi == 0) /* Non-ESP marker. */
1510 return (m); /* NB: no decap. */
1511 skip = sizeof(struct udphdr);
1512 }
1513
1514 /*
1515 * Setup a PACKET_TAG_IPSEC_NAT_T_PORT tag to remember
1516 * the UDP ports. This is required if we want to select
1517 * the right SPD for multiple hosts behind same NAT.
1518 *
1519 * NB: ports are maintained in network byte order everywhere
1520 * in the NAT-T code.
1521 */
1522 tag = m_tag_get(PACKET_TAG_IPSEC_NAT_T_PORTS,
1523 2 * sizeof(uint16_t), M_NOWAIT);
1524 if (tag == NULL) {
1525 IPSECSTAT_INC(ips_in_nomem);
1526 m_freem(m);
1527 return (NULL); /* Discard. */
1528 }
1529 iphlen = off - sizeof(struct udphdr);
1530 udphdr = (struct udphdr *)(data + iphlen);
1531 ((uint16_t *)(tag + 1))[0] = udphdr->uh_sport;
1532 ((uint16_t *)(tag + 1))[1] = udphdr->uh_dport;
1533 m_tag_prepend(m, tag);
1534
1535 /*
1536 * Remove the UDP header (and possibly the non ESP marker)
1537 * IP header length is iphlen
1538 * Before:
1539 * <--- off --->
1540 * +----+------+-----+
1541 * | IP | UDP | ESP |
1542 * +----+------+-----+
1543 * <-skip->
1544 * After:
1545 * +----+-----+
1546 * | IP | ESP |
1547 * +----+-----+
1548 * <-skip->
1549 */
1550 ovbcopy(data, data + skip, iphlen);
1551 m_adj(m, skip);
1552
1553 ip = mtod(m, struct ip *);
1554 ip->ip_len = htons(ntohs(ip->ip_len) - skip);
1555 ip->ip_p = IPPROTO_ESP;
1556
1557 /*
1558 * We cannot yet update the cksums so clear any
1559 * h/w cksum flags as they are no longer valid.
1560 */
1561 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)
1562 m->m_pkthdr.csum_flags &= ~(CSUM_DATA_VALID|CSUM_PSEUDO_HDR);
1563
1564 (void) ipsec4_common_input(m, iphlen, ip->ip_p);
1565 return (NULL); /* NB: consumed, bypass processing. */
1566 }
1567 #endif /* defined(IPSEC) && defined(IPSEC_NAT_T) */
1568
1569 static void
udp_abort(struct socket * so)1570 udp_abort(struct socket *so)
1571 {
1572 struct inpcb *inp;
1573 struct inpcbinfo *pcbinfo;
1574
1575 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1576 inp = sotoinpcb(so);
1577 KASSERT(inp != NULL, ("udp_abort: inp == NULL"));
1578 INP_WLOCK(inp);
1579 if (inp->inp_faddr.s_addr != INADDR_ANY) {
1580 INP_HASH_WLOCK(pcbinfo);
1581 in_pcbdisconnect(inp);
1582 inp->inp_laddr.s_addr = INADDR_ANY;
1583 INP_HASH_WUNLOCK(pcbinfo);
1584 soisdisconnected(so);
1585 }
1586 INP_WUNLOCK(inp);
1587 }
1588
1589 static int
udp_attach(struct socket * so,int proto,struct thread * td)1590 udp_attach(struct socket *so, int proto, struct thread *td)
1591 {
1592 struct inpcb *inp;
1593 struct inpcbinfo *pcbinfo;
1594 int error;
1595
1596 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1597 inp = sotoinpcb(so);
1598 KASSERT(inp == NULL, ("udp_attach: inp != NULL"));
1599 error = soreserve(so, udp_sendspace, udp_recvspace);
1600 if (error)
1601 return (error);
1602 INP_INFO_WLOCK(pcbinfo);
1603 error = in_pcballoc(so, pcbinfo);
1604 if (error) {
1605 INP_INFO_WUNLOCK(pcbinfo);
1606 return (error);
1607 }
1608
1609 inp = sotoinpcb(so);
1610 inp->inp_vflag |= INP_IPV4;
1611 inp->inp_ip_ttl = V_ip_defttl;
1612
1613 error = udp_newudpcb(inp);
1614 if (error) {
1615 in_pcbdetach(inp);
1616 in_pcbfree(inp);
1617 INP_INFO_WUNLOCK(pcbinfo);
1618 return (error);
1619 }
1620
1621 INP_WUNLOCK(inp);
1622 INP_INFO_WUNLOCK(pcbinfo);
1623 return (0);
1624 }
1625 #endif /* INET */
1626
1627 int
udp_set_kernel_tunneling(struct socket * so,udp_tun_func_t f,void * ctx)1628 udp_set_kernel_tunneling(struct socket *so, udp_tun_func_t f, void *ctx)
1629 {
1630 struct inpcb *inp;
1631 struct udpcb *up;
1632
1633 KASSERT(so->so_type == SOCK_DGRAM,
1634 ("udp_set_kernel_tunneling: !dgram"));
1635 inp = sotoinpcb(so);
1636 KASSERT(inp != NULL, ("udp_set_kernel_tunneling: inp == NULL"));
1637 INP_WLOCK(inp);
1638 up = intoudpcb(inp);
1639 if (up->u_tun_func != NULL) {
1640 INP_WUNLOCK(inp);
1641 return (EBUSY);
1642 }
1643 up->u_tun_func = f;
1644 up->u_tun_ctx = ctx;
1645 INP_WUNLOCK(inp);
1646 return (0);
1647 }
1648
1649 #ifdef INET
1650 static int
udp_bind(struct socket * so,struct sockaddr * nam,struct thread * td)1651 udp_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
1652 {
1653 struct inpcb *inp;
1654 struct inpcbinfo *pcbinfo;
1655 int error;
1656
1657 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1658 inp = sotoinpcb(so);
1659 KASSERT(inp != NULL, ("udp_bind: inp == NULL"));
1660 INP_WLOCK(inp);
1661 INP_HASH_WLOCK(pcbinfo);
1662 error = in_pcbbind(inp, nam, td->td_ucred);
1663 INP_HASH_WUNLOCK(pcbinfo);
1664 INP_WUNLOCK(inp);
1665 return (error);
1666 }
1667
1668 static void
udp_close(struct socket * so)1669 udp_close(struct socket *so)
1670 {
1671 struct inpcb *inp;
1672 struct inpcbinfo *pcbinfo;
1673
1674 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1675 inp = sotoinpcb(so);
1676 KASSERT(inp != NULL, ("udp_close: inp == NULL"));
1677 INP_WLOCK(inp);
1678 if (inp->inp_faddr.s_addr != INADDR_ANY) {
1679 INP_HASH_WLOCK(pcbinfo);
1680 in_pcbdisconnect(inp);
1681 inp->inp_laddr.s_addr = INADDR_ANY;
1682 INP_HASH_WUNLOCK(pcbinfo);
1683 soisdisconnected(so);
1684 }
1685 INP_WUNLOCK(inp);
1686 }
1687
1688 static int
udp_connect(struct socket * so,struct sockaddr * nam,struct thread * td)1689 udp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1690 {
1691 struct inpcb *inp;
1692 struct inpcbinfo *pcbinfo;
1693 struct sockaddr_in *sin;
1694 int error;
1695
1696 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1697 inp = sotoinpcb(so);
1698 KASSERT(inp != NULL, ("udp_connect: inp == NULL"));
1699 INP_WLOCK(inp);
1700 if (inp->inp_faddr.s_addr != INADDR_ANY) {
1701 INP_WUNLOCK(inp);
1702 return (EISCONN);
1703 }
1704 sin = (struct sockaddr_in *)nam;
1705 error = prison_remote_ip4(td->td_ucred, &sin->sin_addr);
1706 if (error != 0) {
1707 INP_WUNLOCK(inp);
1708 return (error);
1709 }
1710 INP_HASH_WLOCK(pcbinfo);
1711 error = in_pcbconnect(inp, nam, td->td_ucred);
1712 INP_HASH_WUNLOCK(pcbinfo);
1713 if (error == 0)
1714 soisconnected(so);
1715 INP_WUNLOCK(inp);
1716 return (error);
1717 }
1718
1719 static void
udp_detach(struct socket * so)1720 udp_detach(struct socket *so)
1721 {
1722 struct inpcb *inp;
1723 struct inpcbinfo *pcbinfo;
1724 struct udpcb *up;
1725
1726 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1727 inp = sotoinpcb(so);
1728 KASSERT(inp != NULL, ("udp_detach: inp == NULL"));
1729 KASSERT(inp->inp_faddr.s_addr == INADDR_ANY,
1730 ("udp_detach: not disconnected"));
1731 INP_INFO_WLOCK(pcbinfo);
1732 INP_WLOCK(inp);
1733 up = intoudpcb(inp);
1734 KASSERT(up != NULL, ("%s: up == NULL", __func__));
1735 inp->inp_ppcb = NULL;
1736 in_pcbdetach(inp);
1737 in_pcbfree(inp);
1738 INP_INFO_WUNLOCK(pcbinfo);
1739 udp_discardcb(up);
1740 }
1741
1742 static int
udp_disconnect(struct socket * so)1743 udp_disconnect(struct socket *so)
1744 {
1745 struct inpcb *inp;
1746 struct inpcbinfo *pcbinfo;
1747
1748 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1749 inp = sotoinpcb(so);
1750 KASSERT(inp != NULL, ("udp_disconnect: inp == NULL"));
1751 INP_WLOCK(inp);
1752 if (inp->inp_faddr.s_addr == INADDR_ANY) {
1753 INP_WUNLOCK(inp);
1754 return (ENOTCONN);
1755 }
1756 INP_HASH_WLOCK(pcbinfo);
1757 in_pcbdisconnect(inp);
1758 inp->inp_laddr.s_addr = INADDR_ANY;
1759 INP_HASH_WUNLOCK(pcbinfo);
1760 SOCK_LOCK(so);
1761 so->so_state &= ~SS_ISCONNECTED; /* XXX */
1762 SOCK_UNLOCK(so);
1763 INP_WUNLOCK(inp);
1764 return (0);
1765 }
1766
1767 static int
udp_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * addr,struct mbuf * control,struct thread * td)1768 udp_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
1769 struct mbuf *control, struct thread *td)
1770 {
1771 struct inpcb *inp;
1772
1773 inp = sotoinpcb(so);
1774 KASSERT(inp != NULL, ("udp_send: inp == NULL"));
1775 return (udp_output(inp, m, addr, control, td));
1776 }
1777 #endif /* INET */
1778
1779 int
udp_shutdown(struct socket * so)1780 udp_shutdown(struct socket *so)
1781 {
1782 struct inpcb *inp;
1783
1784 inp = sotoinpcb(so);
1785 KASSERT(inp != NULL, ("udp_shutdown: inp == NULL"));
1786 INP_WLOCK(inp);
1787 socantsendmore(so);
1788 INP_WUNLOCK(inp);
1789 return (0);
1790 }
1791
1792 #ifdef INET
1793 struct pr_usrreqs udp_usrreqs = {
1794 .pru_abort = udp_abort,
1795 .pru_attach = udp_attach,
1796 .pru_bind = udp_bind,
1797 .pru_connect = udp_connect,
1798 .pru_control = in_control,
1799 .pru_detach = udp_detach,
1800 .pru_disconnect = udp_disconnect,
1801 .pru_peeraddr = in_getpeeraddr,
1802 .pru_send = udp_send,
1803 .pru_soreceive = soreceive_dgram,
1804 .pru_sosend = sosend_dgram,
1805 .pru_shutdown = udp_shutdown,
1806 .pru_sockaddr = in_getsockaddr,
1807 .pru_sosetlabel = in_pcbsosetlabel,
1808 .pru_close = udp_close,
1809 };
1810 #endif /* INET */
1811